Hackers abuse Genshin Impact anti-cheat system to disable antivirus

guest · Sep 3, 2022

By Bill Toulas @billtoulas - August 25, 2022

Hackers are abusing an anti-cheat system driver for the immensely popular Genshin Impact game to disable antivirus software while conducting ransomware attacks.

The driver/module, "mhypro2.sys," doesn't need the target system to have the game installed, and it can operate independently or even embedded in malware, offering the threat actors a powerful vulnerability that can disable security software.
Click to expand...

The vulnerable driver has been known since 2020 and gives access to any process/kernel memory and the ability to terminate processes using the highest privileges.
Researchers reported the issue to the vendor multiple times in the past. However, the code-signing certificate hasn't been revoked, so the program can still be installed on Windows without raising any alarms.

To make matters worse, there have been at least two proof-of-concept exploits [1, 2] on GitHub since 2020, with full details on how to read/write kernel memory with kernel mode privileges from user mode, enumerate threads, and terminate processes.
Click to expand...

Abusing Genshin Impact's anti-cheat system
In a new report by Trend Micro, researchers have seen evidence of threat actors abusing this driver since late July 2022, with ransomware actors using it to disable otherwise properly configured endpoint protection solutions.

Trend Micro warns that hackers' deployment of the anti-cheat module may increase, as even if the vendor responds and fixes the flaw, old versions of it will continue to circulate.

"It is still rare to find a module with code signing as a device driver that can be abused," comment the researchers.
Click to expand...

Trend Micro: Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus

We investigate mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware.
Click to expand...

Rasheed187 · Aug 26, 2022

What a joke, how the heck can a driver be used to disable AV's and Windows can't do anything about it, talking about bad design! Also, the writers in the article fail to mention that you can block drivers that you don't trust with behavior blockers like SpyShelter for example.

Log in or Sign up

Hackers abuse Genshin Impact anti-cheat system to disable antivirus

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Hackers abuse Genshin Impact anti-cheat system to disable antivirus

guest Guest

Rasheed187 Registered Member

Useful Searches